I edited Disable =1 in inputs.conf on deploymentserver and reloaded but i see that the sourcetypes are still generating events?? please help

[sridhar2901]

I edited Disable =1 in inputs.conf on deploymentserver and reloaded but i see that the sourcetypes are still generating events?? please help

[FrankVl]

And don't forget to check what "stateOnClient" is set to in your serverclass.conf. By default that is set to enabled, which means that the inputs.conf will get pushed to your forwarders in enabled state regardless of the state you set in inputs.conf on the DS.

stateOnClient = enabled | disabled | noop
* If set to "enabled", sets the application state to enabled on the client,
  regardless of state on the deployment server.
* If set to "disabled", set the application state to disabled on the client,
  regardless of state on the deployment server.
* If set to "noop", the state on the client will be the same as on the
  deployment server.
* Can be overridden at the serverClass level and the serverClass:app level.
* Defaults to enabled.

[sridhar2901]

My Universal forwarders received the changes but they are not restarting to reflect the change. I had to manually restart all of my 16 forwarders.....Why is is happening??

[FrankVl]

What does your serverclass.conf look like?

[493669]

Hi,
You need to make disabled=1 and not disable

disabled = [0|1]
* Whether or not the event collector input is active.
* Set this setting to 1 to disable the input, and 0 to enable it.
* Defaults to 1 (disabled).